Use a previously breached password database like the one haveibeenpwned offers. https://haveibeenpwned.com/Passwords